-
Notifications
You must be signed in to change notification settings - Fork 169
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
new(savefile): introduce scap-file converter skeleton #2168
new(savefile): introduce scap-file converter skeleton #2168
Conversation
Please double check driver/SCHEMA_VERSION file. See versioning. /hold |
Perf diff from master - unit tests
Heap diff from master - unit tests
Heap diff from master - scap file
Benchmarks diff from master
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #2168 +/- ##
==========================================
+ Coverage 74.77% 75.06% +0.28%
==========================================
Files 254 255 +1
Lines 33505 33552 +47
Branches 5747 5736 -11
==========================================
+ Hits 25054 25186 +132
+ Misses 8451 8366 -85
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
fd56382
to
5984e0f
Compare
Signed-off-by: Andrea Terzolo <[email protected]>
Signed-off-by: Andrea Terzolo <[email protected]>
562b48a
to
1775efd
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great job andre, i really like the declarative approach and the shiny new tests (also thanks for remembering to drop the print_scap_event logic from scap-open :D)
Left a bunch of comments!
Signed-off-by: Andrea Terzolo <[email protected]> Co-authored-by: Federico Di Pierro <[email protected]>
d408cf7
to
205a2fa
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/approve
LGTM label has been added. Git tree hash: f815a4c99aea2a9926b6a69cf5a750768e2d1460
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Andreagit97, FedeDP The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/unhold No schema was touched. |
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area libscap-engine-savefile
/area libscap
/area tests
Does this PR require a change in the driver versions?
No
What this PR does / why we need it:
This PR implements the skeleton for the scap-file converter. The idea is to have a declarative converter, so we just need to fill a table and the code should do the rest for us. In this branch, you can find a complete example of how the converter could work https://github.com/falcosecurity/libs/compare/master...Andreagit97:libs:remove_sys_enter_new?expand=1
I'm sharing some highlights directly extracted from that branch here.
The conversion table has as a key
{evt_type, num_params}
and as a value the action to take + some instructions if needed. The idea is to reconstruct the history of our event table from the very beginning and do each conversion until we reach the final event version that we have today in our event table.Let's consider the BRK syscall case:
C_ACTION_SKIP
PPME_SYSCALL_BRK_4_X
with 5 parameters (so the new event version we will introduce in the sys_enter/sys_exit work)The idea is to test each conversion with its own test. This is an example for the BRK syscall
Special notes for your reviewer:
Does this PR introduce a user-facing change?: